#!/bin/bash

CERTS_DIR=/opt/cert
DATA_JSON=data
CFSSL_CONFIG_FILE=$DATA_JSON/ca-config.json

CA_CERT=$CERTS_DIR/ca.pem
CA_KEY=$CERTS_DIR/ca-key.pem


if [ ! -d $CERTS_DIR ]; then
    echo "Creating certs directory: $CERTS_DIR"
    mkdir -p $CERTS_DIR
fi


echo "Step 1. Generating CA certificates"
if [ ! -f $CA_CERT ]; then
    echo "CA cert not found. Creating CA key pair"
    cfssl gencert -config=$CFSSL_CONFIG_FILE -initca $DATA_JSON/ca-csr.json | cfssljson -bare ${CERTS_DIR}/ca
else
    echo "CA key pair already exists!"
fi
ls -la ${CERTS_DIR}/ca*

##################################
# etcd certs
##################################
echo "Step 2. Generating etcd certificates"
# cat data/etcd-csr.json |jq ". | .hosts = [\"127.0.0.1\",\"172.16.0.235\"]"
cfssl gencert -config=$CFSSL_CONFIG_FILE -ca=${CA_CERT} -ca-key=${CA_KEY} -profile=kubernetes ${DATA_JSON}/etcd-csr.json | cfssljson -bare ${CERTS_DIR}/etcd
ls -la ${CERTS_DIR}/etcd*pem

##################################
# flanneld certs
##################################
echo "Step 2.1 Generating flannel certificates"
cfssl gencert -config=$CFSSL_CONFIG_FILE -ca=${CA_CERT} -ca-key=${CA_KEY} -profile=kubernetes ${DATA_JSON}/flannel-csr.json | cfssljson -bare ${CERTS_DIR}/flanneld
ls -la ${CERTS_DIR}/flannel*pem


##################################
# 生成kubectl的admin证书和私钥
##################################
echo "Step 3. Generating certificates for cluster admin"
cfssl gencert -config=$CFSSL_CONFIG_FILE -ca=${CA_CERT} -ca-key=${CA_KEY} -profile=kubernetes ${DATA_JSON}/admin-csr.json | cfssljson -bare ${CERTS_DIR}/admin
ls -la ${CERTS_DIR}/admin*


##################################
# 生成kubernetes-master证书和私钥
##################################
echo "Step 4. Generating certificates for kubernetes API server"
cfssl gencert -config=$CFSSL_CONFIG_FILE -ca=${CA_CERT} -ca-key=${CA_KEY} -profile=kubernetes ${DATA_JSON}/kubernetes-csr.json | cfssljson -bare ${CERTS_DIR}/kubernetes
ls -la ${CERTS_DIR}/kubernetes*pem


##################################
# 生成kube-controller-manager证书和私钥
##################################
echo "Step 5. Generating certificates for kube-controller-manager"
cfssl gencert -config=$CFSSL_CONFIG_FILE -ca=${CA_CERT} -ca-key=${CA_KEY} -profile=kubernetes ${DATA_JSON}/kube-controller-manager-csr.json | cfssljson -bare ${CERTS_DIR}/kube-controller-manager
ls -la ${CERTS_DIR}/kube-controller-manager*pem


##################################
# 生成kube-scheduler证书和私钥
##################################
echo "Step 6. Generating certificates for kube-scheduler"
cfssl gencert -config=$CFSSL_CONFIG_FILE -ca=${CA_CERT} -ca-key=${CA_KEY} -profile=kubernetes ${DATA_JSON}/kube-scheduler-csr.json | cfssljson -bare ${CERTS_DIR}/kube-scheduler
ls -la ${CERTS_DIR}/kube-scheduler*pem



##################################
# 生成kube-proxy证书和私钥
##################################
echo "Step 5. Generating certificates for kube-proxy"
cfssl gencert -config=$CFSSL_CONFIG_FILE -ca=${CA_CERT} -ca-key=${CA_KEY} -profile=kubernetes ${DATA_JSON}/kube-proxy-csr.json | cfssljson -bare ${CERTS_DIR}/kube-proxy
ls -la ${CERTS_DIR}/kube-proxy*pem


##################################
# 生成 cluster-admin 证书和私钥
##################################
echo "Step 5. Generating certificates for cluster-admin"
cfssl gencert -config=$CFSSL_CONFIG_FILE -ca=${CA_CERT} -ca-key=${CA_KEY} -profile=kubernetes ${DATA_JSON}/admin-csr.json | cfssljson -bare ${CERTS_DIR}/admin
ls -la ${CERTS_DIR}/admin*pem
